CODEWITHSUNDEEP
freeradius
Ben Miller
Ben Miller

Reputation: 1484

freeRadius using EAP with custom auth script

I am attempting to setup a freeradius server to authenticate against a web service. The reason for this is that there is a complicated workflow involving account status and mac address. The workflow seemed out of place to be in freeradius. So my user names, and encrypted passwords are stored remotely to the radius server. Everything works fine using radclient to test. When I started using the the Access Point, I learned it only communicates with the radius server via eap-tls. This means that the User-Password argument is not available for my script.

Is there a way to have eap auth check for user authentication against my script? By this i mean, can i get the password to send to my secondary service?

Alternately, is there a way to get the User-Password from the encrypted eap-message data?

Upvotes: 1

Views: 1646

Answers (1)

Arran Cudbard-Bell
Arran Cudbard-Bell

Reputation: 6065

Access points don't usually place restrictions on the EAP type. The device connecting to the AP negotiates an EAP type with FreeRADIUS. If it's using EAP-TLS it's probably a windows machine that hasn't been configured to do anything different.

Investigate EAP flavours to find out which ones are available. If you have EAP-TTLS-PAP you can send the plaintext password from the wireless client, and user it to authenticate against the web service.

In FreeRADIUS v3.0.x there's a rlm_rest module, which can perform basic auth on behalf of the user, with very little configuration.

Upvotes: 1

Related Questions